Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Adobe Reader 7.1.0 not correctly detected

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Adobe Systems
And, this specific program:
Adobe Reader 7.x

This thread has been marked as locked.
_dim_ Adobe Reader 7.1.0 not correctly detected
Member 25th Feb, 2009 00:01
Ranking: 0
Posts: 6
User Since: 24th Feb, 2009
System Score: N/A
Location: N/A
Hi,

As PSI suggested, I have downloaded Adobe Reader 7.1.0 from the Adobe site. This installs and runs without any problems, and displays "version 7.1.0" in its About Box.

However, PSI insists it is still insecure:

Version Detected:
7.0.8.218

Installation Path:
c:\Program Files (x86)\Adobe\Acrobat\Reader\AcroRd32.exe

The problem here seems to be that PSI is looking at the AcroRd32.exe file, which is NOT updated in Adobe Reader 7.1.0 (relative to 7.0.8, at least).

Instead, PSI should probably look at the AcroRd32.dll file, which is the real implementation of Adobe Reader; AcroRd32.exe is just a small wrapper for this DLL. With Adobe Reader 7.1.0 (en-US), the version of AcroRd32.dll is 7.1.0.649, and its SHA-1 is 9d5ec45302c2498f07fbe209fd242b5b8a081e03.

Please consider detecting Adobe Reader using the DLL instead of the EXE file.

moozamoo RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 14:10
Score: 0
Posts: 1
User Since: 12th Jan 2008
System Score: N/A
Location: N/A
I too am having problems with PSi and Adobe. It says that my Adobe is insecure, but if I delete it some programs will not run....HELP
Was this reply relevant?
+0
-0
Underlien RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 14:34
Score: 0
Posts: 95
User Since: 4th Dec 2008
System Score: N/A
Location: DK
Hi

Would it be an idea to uninstall Adobe reader 7 and download version 9 instead?


Underlien
Was this reply relevant?
+0
-0
_dim_ RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 14:40
Score: 0
Posts: 6
User Since: 24th Feb 2009
System Score: N/A
Location: N/A
No, I absolutely despise the UI changes made in Acrobat 8 and 9. (Not to mention it has become even more bloated...)
Was this reply relevant?
+0
-0
Underlien RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 15:07
Score: 0
Posts: 95
User Since: 4th Dec 2008
System Score: N/A
Location: DK
Then maybe Foxit Reader is something for you?


Its way faster than Adobes reader :)



Underlien
Was this reply relevant?
+0
-0
_dim_ RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 19:35
Score: 0
Posts: 6
User Since: 24th Feb 2009
System Score: N/A
Location: N/A
I also use Foxit sometimes, but it has problems with a lot of PDFs out there. Also, the font rendering is (IMHO) inferior to that of Adobe.

In any case, I was just reporting an issue with PSI's *detection* of Adobe Reader 7.1.0, nothing more. No need to go on about which PDF reader is best. :)
Was this reply relevant?
+0
-0
metaed RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 22:52
Score: 1
Posts: 109
User Since: 11th Feb 2009
System Score: 100%
Location: US
This note from the FAQ may or may not be helpful:

"There is a slight delay between the time you update your software and the time that your Secunia PSI installation checks the Secunia database for updated scanning rules. If you would like to update the scanning results immediately after updating your system, scan your entire computer rather than just a particular software."

--
Sometimes they fool you by walking upright.
Was this reply relevant?
+0
-0
_dim_ RE: Adobe Reader 7.1.0 not correctly detected
Member 26th Feb, 2009 23:41
Score: 0
Posts: 6
User Since: 24th Feb 2009
System Score: N/A
Location: N/A
Nope, reloading and rescanning does not help. PSI explicitly searches the AcroRd32.exe file, which isn't updated.
Was this reply relevant?
+0
-0
mantioch RE: Adobe Reader 7.1.0 not correctly detected
Member 27th Feb, 2009 12:47
Score: 0
Posts: 1
User Since: 25th Oct 2008
System Score: N/A
Location: N/A
me too but after installing updates I targeted each one individualy as opposed to a full scan and received full clearance from PSI.Prior to this I ran full scan and kept receiving warnings that four adobes needed urgent update patches. Secunia is a wonderfull tool and if I had not received warning in the first place I would have remained at risk in my ignorance. THANKYOU.All concerned
Was this reply relevant?
+0
-0
Bob_Primak RE: Adobe Reader 7.1.0 not correctly detected
Member 28th Feb, 2009 06:46
Score: 0
Posts: 45
User Since: 28th Feb 2009
System Score: N/A
Location: Hinsdale, Illinois, US
Last edited on 28th Feb, 2009 06:51
See my Reply to the Thread here about the security issues with Adobe Reader.
http://secunia.com/community/forum/thread/show/142...

Post #3

What I said is that PC World has an article which states that Foxit Reader and other non-Adobe PDF Readers (like Nitro PDF) do not have the vulnerability. I personally would never let anything from Adobe anywhere near my computer. Flash Player 10 is horribly insecure, and allows silent spying through your web cam and microphone.

And I have yet to find any PDF on the Internet which I cannot open and clearly display with Foxit Reader in its current version.

--Bob --

--
-- Bob --
Was this reply relevant?
+0
-0
Squiggle RE: Adobe Reader 7.1.0 not correctly detected
Member 24th Oct, 2009 02:11
Score: 0
Posts: 2
User Since: 24th Oct 2009
System Score: N/A
Location: N/A
I too have the same problem. Having just discovered PSI, I tried to update my Adobe Reader 7.0.0. I had some difficulty locating the necessary sequence of updates required in order to get to v. 7.1.4 (via 7.0.7, then 7.1.0, 7.1.3 then 7.1.4)as the options only come up in the Adobe web site if you say that you have XP SP2 running - not SP3 as I have.
Having eventually installed 7.1.4, I find that Secunia still notifies it as insecure - identifying it as 7.0.8.
Looking at the system information, all files are v 7.1.4 except for:-
Acrobat 7.0\Reader\AcroRd32.exe Version 7.0.8.2006051600
Acrobat 7.0\Reader\plug_ins\ImageViewer.API Version 7.0.0.41005
Acrobat 7.0\Reader\plug_ins\LegalPDF.api Version 7.0.5.2005092300

The question is:- do these files need replacing and, if so, how? Or am I safe to ignore them?

Advice please
Was this reply relevant?
+0
-0
Maurice Joyce RE: Adobe Reader 7.1.0 not correctly detected
Handling Contributor 24th Oct, 2009 08:21
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 24th Oct, 2009 08:22
No Adobe vulnerability should be ignored.

Where are these insecuries located?

To locate the exact file that the Secunia PSI has detected, use or switch to the ADVANCED interface, then :

1 Click on the + sign of the programme to “expand’ it.
2 Click on Technical Details in the Toolbox to see the installation path of the detected file. (Copy (CTRL+C) & paste (CTRL+V) the Installation Path of the file back to the Forum if U are unsure what to do next).




--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Squiggle RE: Adobe Reader 7.1.0 not correctly detected
Member 24th Oct, 2009 11:28
Score: 0
Posts: 2
User Since: 24th Oct 2009
System Score: N/A
Location: N/A
"Technical details about this installation of Adobe Reader 7.x, you can use this information to determine why the Secunia PSI detected the program and the security state of it.

Version Detected:
7.0.8.218

Installation Path:
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

Last Inspection of Program:
22nd Oct. 2009, 0:46 CET"

This file is one of 3 which do not appear to have been replaced by running the Adobe 7.1.4 patch (AdbeRdrUpd714_all_incr.msp). I have tried running it three times now and it still doesn't replace this file. Is it possible to replace these individual files (and if so, from where can one obtain them?).Details of all three un-replaced files in previous message.

Advice much appreciated
Was this reply relevant?
+0
-0
_dim_ RE: Adobe Reader 7.1.0 not correctly detected
Member 24th Oct, 2009 12:08
Score: 0
Posts: 6
User Since: 24th Feb 2009
System Score: N/A
Location: N/A
on 24th Oct, 2009 02:11, Squiggle wrote:
Looking at the system information, all files are v 7.1.4 except for:-
Acrobat 7.0\Reader\AcroRd32.exe Version 7.0.8.2006051600
Acrobat 7.0\Reader\plug_ins\ImageViewer.API Version 7.0.0.41005
Acrobat 7.0\Reader\plug_ins\LegalPDF.api Version 7.0.5.2005092300

The question is:- do these files need replacing and, if so, how? Or am I safe to ignore them?


You can safely ignore them. The AcroRd32.exe is just a 'wrapper' for the real reader, which is contained in AcroRd32.dll. If your updates went correct, that DLL should have FileVersion 7.1.4.748.

On my system with a fully updated Acrobat 7.1.4, the two .API files you mention are also at the exact version you mention. These files apparently did not need any fixes.
Was this reply relevant?
+0
-0
Marmy RE: Adobe Reader 7.1.0 not correctly detected
Member 24th Oct, 2009 14:51
Score: 0
Posts: 4
User Since: 23rd Oct 2009
System Score: N/A
Location: N/A
Yes. The dll file is v 7.1.4.748, so on that basis, it seems to have updated OK. - but Secunia is still flagging it as 7.0.8.......

Thanks to all for the responses
Was this reply relevant?
+0
-0
Anthony Wells RE: Adobe Reader 7.1.0 not correctly detected
Expert Contributor 24th Oct, 2009 15:49
Score: 2437
Posts: 3,324
User Since: 19th Dec 2007
System Score: N/A
Location: N/A
Last edited on 24th Oct, 2009 15:53
Hello Marmy and Squiggle ,

While most of the PSI detection rules have been "sorted" , there are still one or two unresolved problems between Secunia and Adobe .

It would do no harm to let support@secunia.com know about your situation . I say this because an "ignore rule" will deprive you of a PSI alert to future security updates :ie: PSI does the scan of Adobe but rhe results are not displayed to you . Not a good idea where Adobe are concerned .

NB :Secunia do not work on PSI at the weekends.

Take care
Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
Marmy RE: Adobe Reader 7.1.0 not correctly detected
Member 27th Oct, 2009 13:28
Score: 0
Posts: 4
User Since: 23rd Oct 2009
System Score: N/A
Location: N/A
I think someone must now have picked up on this as my Adobe 7 Reader is now showing as v 7.1.4.748 and it has moved to the "patched" area. It still shows as a category 5 security threat. Am reluctant to move to
v 8 or 9 because of reputation for "bloatware" - also they do not appear to be any/much more secure than 7.
Perhaps time to explore other readers?!
Was this reply relevant?
+0
-0
Maurice Joyce RE: Adobe Reader 7.1.0 not correctly detected
Handling Contributor 27th Oct, 2009 14:36
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Does this help?
Adobe Reader.
=============

When Adobe free PDF Reader is downloaded it also installs the following programmes:

Adobe.com
Adobe Air (It has a Flash element)
A Google Toolbar if U do not opt out at the download stage.

These additional elements are not required to make Adobe Reader work therefore if U do not use or know what they do go to Control Panel>add/remove & uninstall them.

If U only use Adobe Reader to read web pages or email attachments U do not have to use Adobe Reader either. The Adobe Reader link splattered all over the web saying "To read this article U require Adobe Reader" is utter nonsense. U really require a suitable PDF reader.

Under these circumstance there are far faster, smaller by download size (Adobe is 35.7MB - Foxit 5.04MB) & more secure free alternatives.

If your choice is still to use Adobe Reader U should refer to this update site:

http://www.adobe.com/support/downloads/product.jsp...
This site gives the latest downloads & explains the rather odd way Adobe conduct their update business.

More details are on the Secunia blog here: http://secunia.com/blog/58/

U may also find another programme in add/remove called Adobe Download Manager. The vendor is NOS systems. It is not required to successfully download any Adobe product & can be safely removed.

++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++++++++++++
ALTERNATIVE READERS
===================
The most popular appears to be Foxit - details here:
http://www.foxitsoftware.com/
If U do decide to use Foxit Reader I would strongly advise U use the CUSTOM install. Using this method gives U the opportunity to prevent the following additional "bits" being installed:

Desktop Shortcut
Quick Launch Bar
Firefox Plug In
Ask.com
Shortcut to Ebay.
Despite your best efforts U may well find a Foxit Toolbar has been installed. This can be checked & removed by a visit to add/remove.

More readers are available here:
http://pdfreaders.org/




--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
metaed RE: Adobe Reader 7.1.0 not correctly detected
Member 27th Oct, 2009 18:54
Score: 1
Posts: 109
User Since: 11th Feb 2009
System Score: 100%
Location: US
You probably know this, but the threat level of a patched program does not mean there is a security problem on your PC.

The threat level of a patched program shows the seriousness of the threat that was fixed by the patch.

--
Sometimes they fool you by walking upright.
Was this reply relevant?
+0
-0
bigbadsteve RE: Adobe Reader 7.1.0 not correctly detected
Member 28th Oct, 2009 17:55
Score: 0
Posts: 6
User Since: 11th Jul 2009
System Score: N/A
Location: N/A
Secunia PSI clearly does have a problem with correct version detection. I am also getting the issue with Adobe Reader 8.1.7 being detected as a previous version (different files appear to be involved in this case).

I don't think Adobe Reader 7 is having patches written for it any more, which makes it inherently insecure whatever the subversion. The last patch for it was released way back in 2008:
http://www.adobe.com/support/downloads/product.jsp...

Version 8, however, is still being patched at time of writing. I don't recall any big deal when updating the previous major version, so I'd just install v8 if you want to be safe, or install and use the other program mentioned instead.
Was this reply relevant?
+0
-0
metaed RE: Adobe Reader 7.1.0 not correctly detected
Member 28th Oct, 2009 18:01
Score: 1
Posts: 109
User Since: 11th Feb 2009
System Score: 100%
Location: US
"I don't think Adobe Reader 7 is having patches written for it any more ... The last patch for it was released way back in 2008"

That is incorrect. The last patch for Adobe Reader 7 is AdbeRdrUpd714_all_incr.msp, which was released just this month.

--
Sometimes they fool you by walking upright.
Was this reply relevant?
+0
-0
Marmy RE: Adobe Reader 7.1.0 not correctly detected
Member 29th Oct, 2009 09:55
Score: 0
Posts: 4
User Since: 23rd Oct 2009
System Score: N/A
Location: N/A
Thanks for the advice Maurice. I do need the Flash/Air to view BBC Video Clips on line. But now I look a bit more closely, I think that it should be possible to use these for that function and have a separate PDF viewer? (What I would really like is something to allow me to download the Flash clips from the BBC, but haven’t yet found any software that can do this).

Thanks also Metaed:- I hadn’t realised that the ratings referred to the status ‘before’, rather than ‘after’ the patches had been applied. I have a couple of “end of life” programmes which have been fully patched and are shown as “no threat”, but I assume that Secunia would not pick up any changes to these and move them back into the “insecure” grouping?

Regards & Thanks for all the help
Was this reply relevant?
+0
-0
Maurice Joyce RE: Adobe Reader 7.1.0 not correctly detected
Handling Contributor 29th Oct, 2009 11:14
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 29th Oct, 2009 11:15
@Marmy
I little bit off topic but I watch the BBC a lot & set it up for others.

I use this as a guideline:
http://news.bbc.co.uk/1/hi/help/7277283.stm#audio

Am I missing a trick?

As far as I am concerned the only products U require are:

1. The recommended Windows Media Player Version 11.
2. The latest version of the standalone Adobe Flash Player.

Apart from the standalone Flash I do not, nor will never have, any free Adobe products anywhere near my PC.

What bit of the BBC am I missing by not installing Adobe AIR?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
English Teacher RE: Adobe Reader 7.1.0 not correctly detected
Member 29th Oct, 2009 11:35
Score: 2
Posts: 40
User Since: 27th Dec 2008
System Score: 95%
Location: IT
on 29th Oct, 2009 11:14, Maurice Joyce wrote:
@Marmy
I little bit off topic but I watch the BBC a lot & set it up for others.

I use this as a guideline:
http://news.bbc.co.uk/1/hi/help/7277283.stm#audio

Am I missing a trick?

As far as I am concerned the only products U require are:

1. The recommended Windows Media Player Version 11.
2. The latest version of the standalone Adobe Flash Player.

Apart from the standalone Flash I do not, nor will never have, any free Adobe products anywhere near my PC.

What bit of the BBC am I missing by not installing Adobe AIR?


I would like to know this too. I often watch and listen to the BBC via their website but, unlike Maurice, I use Real Player. Which works well for me.

--
Never argue with Stupid People. They just drag you down to their level and beat you with Experience.

Better to remain silent and be thought a fool, than to speak and remove all doubt.


Was this reply relevant?
+0
-0
Marmy RE: Adobe Reader 7.1.0 not correctly detected
Member 29th Oct, 2009 13:48
Score: 0
Posts: 4
User Since: 23rd Oct 2009
System Score: N/A
Location: N/A
I may have misunderstood, but when I went to remove Air, I got the message "You are about to remove all versions of Adobe AIR. Installed applications that require Adobe AIR will no longer work" It identified BBC iPlayer Desktop as such an application.
The BBC Website says "BBC iPlayer Desktop is powered by Adobe Air (Adobe Integrated Runtime). When you install BBC iPlayer Desktop you also install the Adobe Air components. Air may already be installed on your computer as it is being used by many other applications. Find out more about Adobe Air here."

I do use iPlayer to watch off line, so I may be stuck with it?

Regards
Was this reply relevant?
+0
-0
bigbadsteve RE: Adobe Reader 7.1.0 not correctly detected
Member 29th Oct, 2009 15:55
Score: 0
Posts: 6
User Since: 11th Jul 2009
System Score: N/A
Location: N/A
on 28th Oct, 2009 18:01, metaed wrote:
"I don't think Adobe Reader 7 is having patches written for it any more ... The last patch for it was released way back in 2008"

That is incorrect. The last patch for Adobe Reader 7 is AdbeRdrUpd714_all_incr.msp, which was released just this month.


Oops, my bad, sorry.

The specific issue of the Adobe Reader version being incorrectly detected by Secunia PSI remains. I have created a thread solely for that issue, so would anyone having the same problem re any version of Adobe Reader please post on that issue and that issue only here, quoting your version of Adobe Reader and what version Secunia PSi detected it as (hopefully we'll get Secunia's attention and a bugfix for all versions):
http://secunia.com/community/forum/thread/show/298...
Was this reply relevant?
+0
-0
Maurice Joyce RE: Adobe Reader 7.1.0 not correctly detected
Handling Contributor 30th Oct, 2009 08:35
Score: 11720
Posts: 8,956
User Since: 4th Jan 2009
System Score: N/A
Location: UK
@Marmy
After a bit of research U do need Adobe Air if U have installed BBC iPlayer Desktop to allow U to save video's & watch offline.

Using the player online only requires Windows Media Player V 11 (Recommended) + the standalone version of Adobe Flash.

@English Teacher
Originally U could only watch/hear BBC broadcasts if Real Player was installed. They now only recommend WMP.

Not sure if U will get a better result by switching because I do not have any other player installed to compare.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
Anthony Wells RE: Adobe Reader 7.1.0 not correctly detected
Expert Contributor 30th Oct, 2009 11:23
Score: 2437
Posts: 3,324
User Since: 19th Dec 2007
System Score: N/A
Location: N/A


FWIW , here in France on my system and using Firefox or Chrome , I get better overall connection with Real PLayer (RealAlternative , actually) and am usually offered the choice.

Anthony

--


It always seems impossible until its done.
Nelson Mandela
Was this reply relevant?
+0
-0
blutach RE: Adobe Reader 7.1.0 not correctly detected
Member 1st Nov, 2009 09:40
Score: 0
Posts: 5
User Since: 9th Nov 2008
System Score: 100%
Location: Melbourne, AU
Last edited on 1st Nov, 2009 09:41
@Emil,

Acrobat Reader may be fixed but Acrobat Professional v7 still shows a critical error (the Acrobat.exe stub loader is of course 7.0.8.218 but AcrobatInfo.exe is 7.1.4.748 as is Acrobat.dll).

Regards and thanks


--
Les
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability